Windows Defender Firewall is enabled by default on Windows and Windows Server, but the default rules are broad. The Advanced Security console (wf.msc) and PowerShell let you create precise rules — essential on a Windows VPS that’s reachable from the internet.

How it works

  • Profiles: Domain, Private and Public. A VPS’s network is usually Public — rules must apply to that profile.
  • Default behaviour: inbound connections blocked unless a rule allows them; outbound allowed unless a rule blocks them.
  • Rules match on program, port, protocol, local/remote IP addresses (scope), profile and interface type.
  • Block rules win over allow rules when both match.

Open the console: press Win + R, type wf.msc.

Restrict Remote Desktop to your IP

RDP (TCP 3389) is the most attacked service on Windows servers. Limiting it to known IPs stops almost all brute-force attempts.

In the console: Inbound Rules → find Remote Desktop - User Mode (TCP-In) → Properties → Scope → Remote IP address → These IP addresses → add your IP (or office range).

With PowerShell (run as Administrator):

Set-NetFirewallRule -DisplayGroup "Remote Desktop" -RemoteAddress 203.0.113.50,198.51.100.0/24
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Get-NetFirewallAddressFilter

Make sure your current IP is in the list before applying, or keep the VPS console (VNC) available — otherwise you’ll lock yourself out.

If your IP changes often, use a VPN to the server and allow RDP only from the VPN range. See connecting to a Windows VPS with RDP.

Open a port for an application

Allow a web server or app on TCP 443 and 8443:

New-NetFirewallRule -DisplayName "Web HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443,8443 -Action Allow -Profile Any

Game server on UDP ports:

New-NetFirewallRule -DisplayName "Game UDP" -Direction Inbound -Protocol UDP -LocalPort 27015-27030 -Action Allow

Allow a program instead of a port

Useful when an app uses dynamic ports:

New-NetFirewallRule -DisplayName "MyApp" -Direction Inbound -Program "C:\Apps\MyApp\myapp.exe" -Action Allow

Restrict a database to one server

New-NetFirewallRule -DisplayName "SQL Server from app server" -Direction Inbound -Protocol TCP -LocalPort 1433 `
  -RemoteAddress 10.10.0.1 -Action Allow

Never expose SQL Server or MySQL ports to the whole internet.

Outbound rules

Block an application from reaching the internet:

New-NetFirewallRule -DisplayName "Block Updater" -Direction Outbound -Program "C:\Apps\Tool\updater.exe" -Action Block

For a stricter server, you can set the default outbound action to Block and allow only what’s needed — but test carefully; Windows Update, time sync, DNS and licensing must still work.

Turn on logging

Set-NetFirewallProfile -Profile Domain,Private,Public -LogBlocked True -LogFileName "%systemroot%\system32\LogFiles\Firewall\pfirewall.log" -LogMaxSizeKilobytes 16384

Review the log to see what’s being blocked when troubleshooting.

Review and clean up rules

Get-NetFirewallRule -Direction Inbound -Enabled True |
  Where-Object Action -eq Allow |
  Select-Object DisplayName, Profile |
  Sort-Object DisplayName

Disable rules you don’t need: Disable-NetFirewallRule -DisplayName "…".

Export/import a full policy (for backup or copying to another server):

netsh advfirewall export "C:\fw-backup.wfw"
netsh advfirewall import "C:\fw-backup.wfw"

Checklist for a Windows VPS

  • RDP limited to your IPs (or VPN), strong passwords, account lockout policy
  • Only required application ports open
  • Databases restricted to specific servers
  • Logging of blocked connections enabled
  • Windows Update active — see also Windows Event Logging

Running Windows Server? Our Windows VPS plans include a VNC console in the control panel for recovery if a firewall rule goes wrong.

  • Windows
  • Firewall
  • Security